3

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers.

Despite /etc/selinux/config being set with disabled or permissive, when the servers boot, selinux is in enforcing mode again.

The only way to disable SELinux is by doing echo 0 > /proc/sys/net/ipv4/tcp_syncookies every time the servers boot.

I know that one solution could be to do a cron job with the abovementioned command on every boot but I wonder if anyone has some idea of what could be the reason why the modification of /etc/selinux/config is not enough (maybe it is enabled somewhere else; any idea on where to look or how to find it?).

migrated from stackoverflow.com Jan 29 '12 at 21:18

This question came from our site for professional and enthusiast programmers.

5

In /etc/sysconfig/selinux you want to have SELINUX=disabled and reboot.

Source: http://www.centos.org/docs/5/html/5.2/Deployment_Guide/sec-sel-enable-disable.html

  • You are right, there is also /etc/sysconfig/selinux but both /etc/selinux/config and /etc/sysconfig/selinux are set as SELINUX=disabled and despite of that cat /proc/sys/net/ipv4/tcp_syncookies still says 1 after reboot. – Zillo Jan 28 '12 at 20:11
  • Just found the solution. No need to disable selinux, just to edit /etc/sysctl.conf where it says net.ipv4.tcp_syncookies = 1 to net.ipv4.tcp_syncookies = 0 – Zillo Jan 28 '12 at 20:29
  • @Zilo could you post that as an answer please for posterity? – Kyle Jones Jan 31 '12 at 6:10
2

While I would rather keep SELinux on and make a policy to allow whatever is breaking your server you can always try this to disable SELinux.

$: sudo echo 0 > /selinux/enforce
  • This command failed for me - I needed to run it completely in a subshell so 'root' was actually "writing the file", viz: > > $ sudo echo 0 > /selinux/enforce > -bash: /selinux/enforce: Permission denied > $ sudo bash -c 'echo 0 > /selinux/enforce' > $ – rich p Oct 20 '15 at 2:12
  • This worked better: $ sudo bash -c 'echo 0 > /selinux/enforce' – rich p Oct 20 '15 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy